XWiki: LDAP/OIDC admin mapping, config mounts, and REST installs

- LDAP: move settings to xwiki.cfg; enable trylocal (1/0), group_mapping to XWiki.XWikiAdminGroup,
  and mode_group_sync=always.
- OIDC: add groups claim request (oidc.userinfoclaims), map provider group to XWiki.XWikiAdminGroup,
  and use space-separated scopes.
- Compose: mount xwiki.cfg and xwiki.properties into /usr/local/xwiki.
- Extensions: wait for REST readiness; pre-check OIDC/LDAP extensions (URL-encoded IDs);
  install via REST job only if missing.
- Vars: strict mappings to LDAP.* and OIDC.* (no defaults), add XWIKI_ADMIN_GROUP and derived DNs.
- Config: expose ldap.local_enabled; tidy meta tags; README grammar update.

Conversation: https://chatgpt.com/share/68c2b8ad-4814-800f-b377-065f967998db

roles/web-app-xwiki/templates/xwiki.properties.j2

@@ -0,0 +1,16 @@
+############################################
+# OIDC
+{% if XWIKI_OIDC_ENABLED | bool %}
+oidc.provider={{ XWIKI_OIDC_PROVIDER }}
+oidc.endpoint.authorization={{ XWIKI_OIDC_AUTHORIZATION }}
+oidc.endpoint.token={{ XWIKI_OIDC_TOKEN }}
+oidc.endpoint.userinfo={{ XWIKI_OIDC_USERINFO }}
+oidc.endpoint.logout={{ XWIKI_OIDC_LOGOUT }}
+oidc.clientid={{ XWIKI_OIDC_CLIENT_ID }}
+oidc.secret={{ XWIKI_OIDC_CLIENT_SECRET }}
+oidc.scope={{ XWIKI_OIDC_SCOPES }}
+oidc.enableUser=true
+oidc.userinfoclaims={{ XWIKI_OIDC_GROUPS_CLAIM }}
+oidc.groups.claim={{ XWIKI_OIDC_GROUPS_CLAIM }}
+oidc.groups.mapping=XWiki.XWikiAdminGroup={{ XWIKI_OIDC_ADMIN_PROVIDER_GROUP }}
+{% endif %}